Continuing the battle of the VPN's, previously

 https://growmane.blogspot.com/2025/10/in-wind-down-to-starting-line-came-mane.html

 The home network evolved to a bunch of scripts, partially AI generated, to magically manetain a VPN connection behind DHCP, with no container.  That script still can't handle DHCP reverting the default route to the Comca$t router instead of the VPN router.  Lions have manually deleted the default route when it did that.  It hasn't lead to any packet leakage, somehow.  It seems to just break all routing.

 The solution probably involves sniffing out the Comca$t router from the DHCP cache, polling the routing table for when DHCP forces it in.

 The mane focus now is the day job VPN.  They migrated to public key authentication, in addition to a username password.  For openconnect, this required adding the .pem files to the command line.  Every month, you have to download new .pems.  Inside a container, it still needed mtu arguments.

 

 echo "PASSWORD" | openconnect --mtu=1400 --base-mtu=1400 --user=USERNAME --passwd-on-stdin --protocol=gp -c mycert.pem -k myprivkey.pem vpn_hostname.com

 

Lions kept getting a Server certificate verify failed: certificate does not match hostname

It would interactively prompt for a yes because of this error, which made it impossible to run in a script.  It turns out the VPN server argument has to be the full hostname of the server instead of the IP address.  In this case, since DNS requires the VPN & it can't access the VPN without DNS, you have to put the hostname in /etc/hosts

 

IP_ADDRESS vpn_hostname.com

 Another problem was a failure during TCP connect.  They were blocking all the Comca$t addresses in the dynamic IPv4 pool.  Lions may have to move to IPv6 eventually.  All this is from the exponential growth of AI generated exploits, now breaking through every new countermeasure in just minutes.

-------------------------------------------------------------------------------------------

 From the department of who'd have thunk, thought the capsized alcatraz boat was 1 of the ridiculously small tour boats younger lions saw all the time.  They were so small, it looked like the passengers were standing on the water.   They packed them as much as possible for revenue. 

 It actually was a 3 story boat, but probably top heavy.  Only the top floor stayed above water.  The chumps below decks were trapped.                 

  Got to get your clothing off & float on your back or else.  Fortunately, wouldn't have had a lot of clothing that day.

If a kayak flips over, you're already wearing a life vest & unenclosed. The internet warned of manatees flipping kayaks over.

 

 

 

 

 

 

 

 

Comments

Post a Comment

Popular posts from this blog

Image
 https://finance.yahoo.com/personal-finance/investing/article/as-the-average-retirement-age-continues-to-rise-will-passive-income-be-the-solution-162047139.html Cutting through another load of AI filler, Boston College & Grok say the retirement age is rising yet all the gootube commenters say the retirement age is falling.  Always bad news from organized media.  Always good news from the internet demographic.  Suspect the internet is still manely the geeks, technology professionals, high earners with the means to be online most hours.  So the stonk market melted up when the government shut down & crashed when the government reopened.  Only the government can make the stonk market crash. It wasn't government pension funds but government borrowing. --------------------------------------------------    https://growmane.blogspot.com/2025/02/s-bear-market-being-what-it-is-apple.html Then lions realized the natural spoken language interfaces ...
Read more
Image
Its theatric run over in 1 month, Project Hail Mary arrived on the hard drive in short order.   After running the Michael Jackson movie for just a week, the IMAX theater now seems to be derelict.  They could be reserving it for private screenings or it could be too expensive to operate. It's a growing number of movies which won't be available in blu ray.  Lions continued to be perplexed by the inferior quality of webrips.      Skimming through it, the resemblance to 80's depictions of the future was striking.         It was a time when the future was painted white & noodled.  Sometimes you have to go back to go forward.   Moving on, they made every effort to pack as much of the book in a 2:30 screening time as possible.  The shots are all very quick.  It was like watching normal movies at 2x.  The book being intended from the start to be a movie definitely helped.   Computer animated exterior s...
Read more
Image
   Amusing that Grok applied an IPv6 style pseudo header to the computation of an IPv4 ping packet, even though IPv4 doesn't use the pseudo header.       Another Grok error was in a basic TCP demonstrator.  To avoid a TIMED_WAIT on the server blocking the port, you have to exit the server without closing the socket.   These errors take a lot more time to track down than doing it the old way.  It might be fixed in paid versions of Grok. The solution to everything ------------------------------------------------------------------------------------------------------------------- The 2nd Krispy Kreme run.  Always a satisfied mane after 6 miles.  Always a horrible bloating, after 13 miles.  Noted the half marathon times with mane feedings are on pace for the lion kingdom's best full marathon time.  Lions took a step down from their maximum power delivery in the shortest time when the leash enabled food breaks.  Before then...
Read more